Security readout for executives and security teams
Plain-English summary
This is a Linux kernel availability bug affecting IBM s390 DASD storage handling. A race condition can leave an internal pointer unset, causing a kernel Oops. The documented impact is system availability, not data theft or data modification. Exposure is narrow and mainly relevant to s390 environments using DASD/PAV storage.
Executive priority
Patch during the next appropriate maintenance window for affected s390 storage hosts. Escalate sooner where those systems support critical business workloads or where many local users can access the host.
Technical view
The flaw is a NULL pointer dereference in dasd_alias_get_start_dev(). The pavgroup pointer was checked before taking lcu->lock, leaving a race with _lcu_update(), which can set pavgroup to NULL while holding that lock. The fix rechecks pavgroup while lcu->lock is held.
Likely exposure
Likely exposure is limited to Linux on IBM s390 systems using DASD alias/PAV functionality. The CVE lists affected Linux versions and kernel stable fixes. General Linux systems outside this storage architecture are unlikely to be exposed based on the provided sources.
Exploitation context
The CVSS vector indicates local access with low privileges, no user interaction, and high availability impact. The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Treat this as a local denial-of-service risk unless vendor advisories say otherwise.
Researcher notes
The key condition is a locking race around pavgroup in the DASD alias path. Validation should focus on architecture, DASD/PAV usage, and whether the vendor kernel includes one of the referenced stable commits or an equivalent backport.
Mitigation direction
- Apply a vendor kernel update containing the referenced stable fix.
- Prioritize s390 systems using DASD alias or PAV storage.
- Check distribution advisories for backported fixes, not only upstream version numbers.
- Restrict local shell access on affected systems until patched.
- Reboot into the fixed kernel where required by the vendor package.
Validation and detection
- Inventory Linux hosts running on s390 or s390x architecture.
- Identify systems using DASD alias or PAV storage functionality.
- Compare installed kernel packages against vendor advisories for CVE-2022-48636.
- Confirm the running kernel includes the stable fix after maintenance.
- Review kernel logs for Oops messages referencing DASD alias handling.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-48636 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d86b4267834e6d4af62e3073e48166e349ab1b70CVE reference, Linux
- https://git.kernel.org/stable/c/49f401a98b318761ca2e15d4c7869a20043fbed4CVE reference, Linux
- https://git.kernel.org/stable/c/aaba5ff2742043705bc4c02fd0b2b246e2e16da1CVE reference, Linux
- https://git.kernel.org/stable/c/2e473351400e3dd66f0b71eddcef82ee45a584c1CVE reference, Linux
- https://git.kernel.org/stable/c/f5fcc9d6d71d9ff7fdbdd4b89074e6e24fffc20bCVE reference, Linux
- https://git.kernel.org/stable/c/d3a67c21b18f33c79382084af556557c442f12a6CVE reference, Linux
- https://git.kernel.org/stable/c/650a2e79d176db753654d3dde88e53a2033036acCVE reference, Linux
- https://git.kernel.org/stable/c/db7ba07108a48c0f95b74fabbfd5d63e924f992dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.